PT-2026-44912

Summary ArrayFunctions.InsertAt in Scriban allocates index - list.Count null entries in a tight C for loop with no bound on index. The function is exposed to template authors as array.insert at, and the fill loop ignores every existing safety control: LoopLimit, LimitToString, ObjectRecursionLimi...